CVE-2026-115923

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1

Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL readers canonicalize the URL before fetching it. An authenticated user with catalog.location.create permission can utilize percent-encoded path segments to make an untrusted URL appear to match a trusted location pattern, even if the canonical URL resolves outside that scope. This allows entity content from an untrusted source to be treated as trusted.

Recommendations Update to version 3.9.2 or later. Update to version 4.0.2 or later.